Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

lenai (threat actor)

Risk

Medium

1 techniques 40 tools/malware 0 vulnerabilities 21 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1179

Stage risk: Critical High Medium None

Tools & Malware (40)

Alien Beacon CALENDAR ClearFake ClickFix Code-signing certificates Colony Compromised WordPress Sites EtherHiding Expand Explorer Firefox Global Guard Keenadu Legitimate Software Leverage MAUI Malicious files Malware Nevada Node.js NodeJS PHOTO Payload Payload Persistence mechanisms Play PowerShell PowerShell commands Royal STOP Scheduled Tasks SentinelOne Trojans cmd.exe malware distribution node.exe powershell.exe schtasks

Indicators of Compromise (21)

Domain

bsc-testnet.drpc.org Urlscan.io workers.dev TheBump.com data-seed-prebsc-1-s1.bnbchain.org URLScan.io

Email Address

ghatcher@usgs.gov

Filename

of.js powershell.exe Editor.lnk css.js or.js cmd.exe Node.js node.exe +3 more

IPv6 Address

60:2e:9f:12:0b:c6:c9:e0 75:04:56:1b:27:35:f3:37

URL

http://ip-info.ff.avast.com/v2/info

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

lenai

Type: Unknown Active

Patriot Action Wells Fargo Employee PAC

Infrastructure 9 IOC(s)

50%

Domain

bsc-testnet.drpc.org Urlscan.io workers.dev TheBump.com data-seed-prebsc-1-s1.bnbchain.org +1

IPv6 Address

60:2e:9f:12:0b:c6:c9:e0 75:04:56:1b:27:35:f3:37

URL

http://ip-info.ff.avast.com/v2/info

Artifacts (12)

ghatcher@usgs.gov of.js powershell.exe Editor.lnk css.js or.js +6

Capability

50%

1 technique(s) 40 tool(s)/malware

Alien Beacon CALENDAR ClearFake ClickFix Code-signing certificates Colony Compromised WordPress Sites +32

T1179

Victim

70%

Targeted Sectors

government defense healthcare manufacturing food-agriculture non-profit critical-infrastructure aviation financial-services education

Targeted Countries

US IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges